consent-engine v0.6.11

feat: v0.6.11 — weighted jurisdiction scorer + no-GCS claims discipline

Fast-follows from the v0.6.10 launch stress test:

• Generic-TLD jurisdiction now uses a weighted multi-signal scorer. A strong
  declared locale, UK identity, operator-identity, or US declaration is decisive
  on its own; weak signals (currency symbols, supervisory-authority mentions)
  only corroborate, so no single weak signal flips the US baseline. The resolver
  returns a confidence flag and the report note reads "auto-detected from site
  signals" (high) vs "inferred (low confidence); pass --jurisdiction to override"
  (low). Country-code TLDs stay a high-confidence hard rule.
• The confirmed-to-observed downgrade now covers every non-definitive methodology,
  so no-Google-Consent-Mode sites (BBC-type IAB-TCF publishers) report firings as
  observed / requires-investigation, matching the methodology-gated zero headline.

10 new scorer/confidence tests; all 28 jurisdiction tests preserved. Full suite
191 passing (incl. the [mcp] extra); ruff and mypy clean on both lanes.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com